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PORT TREND ANALYSIS SYSTEM AND METHOD FOR 
TRENDING PORT BURST INFORMATION 
ASSOCIATED WITH A COMMUNICATIONS DEVICE 



CLAIM OF PRIORITY 

This document claims priority to and I the benefit of the fiHng date of co-pending and 
commonly assigned provisional application eiltitkd^'A METHOD FOR CALCULATING AND . 
DISPLAYING A RECOMMENDED PORT SPEED", filed February 14, 2000,^attomey docket 
number 061606-8470, and incorporated herem by reference. 



TECHNICAL FIELD 

The present invention relates generally to data communication management systems, and 
more particularly, to a system and method for automatically determining a recommended digital 
transmitter/receiver device size or capacity, such as for a network switch or a relay device in a 
frame relay network, by analyzing historical information regarding transmitted and received burst 
information and by recommending adjustments to the device size or capacity based on the 
analysis. 



BACKGROUND OF THE INVENTION 

ki the field of data communications, communication equipment such as a modem, a data 
service unit (DSU), or a channel service unit (CSU) is used to convey information from one 
location to another. Digital technology now enables modems or other communication devices, 
such as network switches, frame relay data service units (DSU's), frame relay access units 
(FRAU's), and asynchronous transfer mode (ATM) communication devices to communicate 
large amounts of data in a packetized digital format. This packetized digital communication 
format generally adheres to a model, such as the well known Open Systems hiterconnect (OSI) 
seven-layer model, which specifies the parameters and conditions under which information is 
formatted into a digital data packet and transferred over a communications network. 

Frame-relay networks, well known in the art, are one implementation of a packet- 
switching network. A packet-switching network allows multiple users to share data network 
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facilities and bandwidth, as contrasted with a circuit-switching network which provides a specific 
amount of dedicated bandwidth to each user. Packet switches divide bandwidth into 
connectionless, virtual circuits. A virtual circuit can be a permanent virtual circuit (PVC) or a 
switched virtual circuit (SVC). As is well known, virtual circuit bandwidth is consumed only 

5 when data is actually transmitted. Otherwise, the bandwidth is not used. In this way, packet- 
switching networks essentially mirror the operation of a statistical multiplexer (whereby multiple 
logical users share a single network access circuit). Frame relay systems generally operate within 
layer 2 (the data link layer) of the OSI model, and are an improvement over previous packet 
switching techniques, such as X.25, in that a frame relay system requires significantly less 

10 control overhead. 

In frame relay networks, as in other communication networks, access to the frame relay 
network is provided by a network service provider (NSP). These NSPs generally provide the 
communication and switching facilities over which the above-mentioned communication devices 

m operate. Typically, an end user contracts with an NSP for network services. An example of such 

IB 

ig a network is a public switched service network. An example of a public switched network is the 
;4 pubhc switched telephone network (PSTN) or a public data network (PDN). These public 
^-=^ networks typically sell network services, in the form of connectivity, to end users. 
O A user may purchase a particular level of service from the NSP. This level of service can 

I A be measured by, for example, network availability as a percentage of total time on the network, 
2p the amount of data actually delivered through the network compared to the amount of data 
(□ attempted or possibly the network latency, or the amount of time it takes for a particular 
communication to traverse the network. Often, for example, an NSP may provision services to 
an end user by specifying a committed information rate (CIR). The CIR is the minimum data 
communication rate that the NSP guarantees to the user. The CIR is typically some fraction of 
25 the total available access line rate of the particular service being provisioned. For example, in a 
frame relay network, the access line rate may be 1536000 bits/second (Tl rate including 24 64- 
kilobit (KB) channels for a total of 1.544 megabits/second (MB/s) including 8KB signaling), 
while the CIR may be 48000 bytes/second (384000 bits/second (b/s)). That is, for this example, 
the NSP may guarantee a communication rate of 384000 b/s, while the total available line rate 
30 maybe 1536000 b/s. 
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FIG. 1 shows a communication environment 22 in which a plurality of user devices 24a 
and 24b reside. Each user device 24a and 24b, are connected to a communication device 26a and 
26b, respectively, such as a frame relay access unit (FRAU), via connections 28a and 28b, 
respectively. User devices 24a and 24b are typically customer premises equipment, such as 
5 routers or the like, which may be connected to a local area network (LAN) or the like and 
residing off the NSP network 30. One skilled in the art will realize that the communication 
devices and user devices may be of any of a wide variety of devices commonly employed in the 
industry. 

For simplicity and as an example, only two communication devices 26a and 26b, are 
10 depicted in FIG. 1. In practice, a communication environment 22 will contain many 

communication devices. Communication devices 26a and 26b are considered communication 

endpoints and communicate with each other over an NSP network 30, in a conventional manner. 
,Q NSP network 30 can be, for example, any network that provides connectivity for communication 
•Li devices 26a and 26b, and in the illustrative example of FIG. 1, is a frame relay communication 
IC network. NSP network 30 illustratively connects to communication devices 26a and 26b over 
Q connections 32a and 32b, respectively. Connections 32a and 32b can be physical links and can 

be, for example but not limited to, Tl/El service or any digital data service (DDS). 
Q NSP network 30 is typically characterized by a mesh network of links (not shown) 

j J interconnecting a matrix of intermediate nodes (not shown) through network switches, such as 
2)gc switches 34 and 36, which is well known in the art. For simplicity and as an example, only two 
D network switches 34 and 36 are illustrated herein; however, NSP network 30 will typically 

contain many network switching devices. Link 38 connects network switch 34 with network 

switch 36. 

Communication devices 26a and 26b are illustratively shown to have an input port 40a 
25 and 40b, respectively, which provides for the point of connection with user devices 24a and 24b, 
respectively, over their respective connections 28a and 28b. Communication devices 26a and 
26b have output ports 42a and 42b, respectively, which provide for connectivity to NSP network 
30 via their respective connections 32a and 32b. Similarly, network switches 34 and 36, utilize 
ports to provide connections to the various communication devices and other network switches to 
30 which they connect (not shown). In the illustrative example of FIG. 1, port 44a of network 
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switch 34 provides the connection point to connection 32a, thereby providing connectivity to 
communication device 26a. Likewise, port 44b of network switch 36 provides the connection 
point to connection 32b, thereby providing connectivity to communication device 26b. Port 46a 
of network switch 34 provides the connection to Unk 38 and port 46b of network switch 36 
5 provides the connection to link 38, thereby connecting network switches 34 and 36. For 
simphcity, network switch 34 is shown as having only two ports, 44a and 46a. As is well known 
in the art, network switches are typically multi-port devices having a plurality of ports (not 
shown) which provide connections to a plurality of communication devices (not shown) residing 
outside of NSP network 30, and a plurality of ports providing cormection points to a plurality of 
10 links (not shown) which are connected similarly to a plurality of other network switches (not 
shown) residing within NSP network 30. 
^ The rated capacity of communication device 26a is based upon the maximum amount of 

data transmission that the communication device 26a can accommodate without errors. Rated 
P capacity, as defined hereinafter, is the maximum amount of data in bits which can be transmitted 
10 in the transmit (Tx) direction or the receive (Rx) direction during a specified period of time. The 
p rated capacity of communication device 26a is typically referred to as rated port speed, and 
usually defined in terms of kilo-bits of data transferred over a one second period (kbps) in the Tx 
y or the Rx direction. Here, after this illustrative example, the Tx direction is defined as 
y communications fi"om user device 24a out through communication 26a to NSP network 30. The 
ipk Rx direction is defined as communications from NSP network 30 in through communication 
Q device 26a to user device 24a. A port having both simultaneous TX capability, known as the 
transmit side of the port, and Rx capability, known as the receive side of the port, is commonly 
referred to as a full duplex port. Likewise, each port of a network switch or other devices 
residing in NSP network 30 may have similarly defined port speeds. A network switch may have 
25 a plurality of ports residing in the network switch with each port having a unique port speed. 

The actual data transmission rate for any given time period of user device 24a is the 
aggregation of the actual data transmitted in one direction (either the Tx or Rx direction), by all 
the individual transmission users connected through user device 24a. Many PC users would 
typically be connected onto a LAN 48 which is connected to user device 24a. For example, user 
30 A and user B may be transmitting into the NSP network 30 (Tx direction) while user X and user 
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Y may be, at approximately the same time, receiving data from the NSP network 30 (Rx 
direction). Communication device 26a should have sufficient capacity to accommodate this 
bidirectional data traffic. That is, communication device 26a should have sufficient Tx capacity 
to accommodate the transmissions of user A and user B. Likewise, communication device 26a 
5 should have sufficient Rx capacity to accommodate the receiving of data by user X and user Y. 

Some of the above described communication environments may be used to transmit 
"bursty" data traffic. A burst can be characterized as a continuous stream of bits transmitted 
through the port. A burst, which may contain one or more frames of a digital data, correlates to 
the speed of the data transmission through the port. Jn packet switching environments, bursts 
10 may have the data in a single frame or a burst may have the data in multiple strings of frames 
which are continuously stacked together such that there are no gaps in data transmission between 
one frame and the succeeding frame, as is well known in the art. Thus, a burst can be specified 
in terms of speed, such as bits per second, kilo-bits per second (kbps), mega-bits per second 
IfJ (Mb/s), or the like. Burstiness in this context can best be described as Tx or Rx data 
l£= communication traffic that is sporadic in nature, with bursts of traffic occurring at frequent, but 
p irregular, time intervals. As the users connected to LAN 48 transmit to NSP 30, the user device 
24a assembles the transmitted data into a stream of outgoing data (Tx direction) which is then 
transmitted to NSP 30 through communication device 26a. Similarly, the user device 24a 
receives a stream of incoming data (Rx direction) from the NSP network 30, through 
?gj communication device 26a, destined for the users connected to LAN 48. The random, 
0 aggregation of data transmitted or received by the users gives rise to the "bursty" nature of the 
data traffic. 

Optimal operation of the communication enviroimient 22, in theory, would have 
sufficient rated transmission capacity for each and every port in the network, as measured by 
25 rated port speed, to accommodate the total data transmission requirements of each device to 
which it is connected. As long as the actual data transmission rate through a port is less than the 
rated port speed, the communication device will have adequate transmission capacity to 
successfially transmit all of the data. However, if a communication device attempts to transmit 
data at a rate in excess of rated port speed, data that is in excess of the rated port speed might be 
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discarded or unnecessarily delayed. Discarding of data or excessive delay in transmission is 
undesirable. 

For example, ports 40a and 42a of communication device 26a should ideally have 
adequate port speed to accommodate the aggregate transmission of all data from NSP netv^ork 30 
(Rx direction) that is sent to user device 24a, and the aggregate transmission of all data from user 
device 24a (Tx direction) that is sent to NSP network 30. Once the data transmission capacity of 
a port is fully utilized, that is, the port is operating at its rated port speed in either the Tx or Rx 
directions, further attempts to transmit additional data through the communication device 26a (in 
excess of the port speed) may result in discarded data or excessively delayed transmission of 
data. Therefore, the speed of ports 40a and 42a should ideally be at least as great as the actual 
instantaneous total data transmission rate to avoid discarding of data or avoid delays in data 
transmission. 

Because attempts to transmit data at rates greater than the capacity of the communication 
device may result in data being discarded or in unacceptable delays in data transmission, proper 
sizing of the communication devices in a communication environment 22 is a key planning 
parameter for both service providers and end users. Therefore, it is incumbent upon the network 
engineer designing a communication network to specify the rated transmission capacity of a 
communication device, as defined by rated port speed, to be adequate to accommodate 
anticipated data transmissions with acceptable loss and delay. When a user device 24a and its 
associated communication device 26a are initially connected to a NSP network 30, the network 
engineer sizes the port speed of the communication device 26a based upon the anticipated data 
transmission requirements of all users interconnecting through LAN 48 to the user device 24a. 
Since communication devices typically are constructed in discreet sizes (discreet port speed 
ratings), the network engineer would typically select the communication device 26a having a 
rated speed of ports 40a and 42a of the next discreet size which exceeds the anticipated 
maximum aggregate data transmission from/to the user device 24a. That is, the network engineer 
should ideally select a communication device 26a having at least the next increment of rated 
speed for ports 40a and 42a that is greater that the anticipated port speed requirements. 
Therefore, there is likely some inherent amount of available transmission capacity, or port speed. 
This excess port capacity may be used to accommodate some measure of growth in traffic, such 




TKHR Docket No. 061607-1470 



as when more users are connected onto the user device, or, to accommodate unanticipated high 
bursts of data transmissions. 

However, as more and more users are connected onto LAN 48 through the user device 
24a, loading on the associated ports 40a and 42a will increase and eventually reach the rated port 
speed. At some point, the communication device 26a may be asked to transmit data in excess of 
the rated speed of ports 40a and 42a, resulting in discarded or delayed data. If discarded or 
delayed data reaches unacceptable levels, the network engineer would likely recommend 
increasing the speed of ports 40a and 42a. 

Alternatively, some users connected to LAN 48 may leave. Loading on the ports 40a and 
42a may decrease over time to such an extent that it may become economically desirable to 
downsize data transmission capacity by decreasing the speed of ports 40a and/or 42a. 

One problem with current management systems of communications networks having 
bursty communication is that it may be difficult for a network engineer to determine whether 
rated port speeds are adequate (either in terms of insufficient port speed or uneconomical excess 
port speed) on an ongoing basis. To the extent that current communication management system 
practices address these problems at all, such systems are limited to informing the network 
engineer, in the simplest possible terms, whether or not port speed may be adequate. 

Furthermore, current communication management systems, whether automatic or manual, 
are incapable of determining and recommending to the network engineer the amount by which 
the port speed should be increased (or decreased). 

Therefore, there is a need in the industry for a system and method that automatically 
analyzes historical data and proactively recommends specific adjustments to the rated port speeds 
based on such analysis. 



Using historical data and trending analyses, the port trend analysis system in accordance 
with the present invention provides a unique method for analyzing the performance of a port 
residing in a communications device in a bursty communication network and recommending 
changes to port speed based upon the trending analysis. If the port trend analysis system 
indicates that port speed is inadequate, or trend analysis indicates that port speed may be 
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inadequate in the future, a recommendation may be made to increase port speed, including the 
magnitude of increase of the port speed. If the port trend analysis system indicates excess 
capacity, a decrease in port speed may be recommended. Information relevant to the analysis, as 
well as the ultimate recommendation, are displayed to the user. 

^^^^^^^^^<^ \~^^I^^ pf^rt t^priH^aruUyfiifi — cycfpm prnviHps ap j mprnyp. rPf n t to a rnmmni^^ 

•^^^^^^l-^fnana^^ system, wherein the port trend analysis system calculates and presents-t6^anetwork 
administrator or a network engineer various views of the perfoimafl6e of the port and 
recommendations for port speed increases or decreases. ThisiafSmiation enables the network 
administrator or network engineer to determine wheth^^^rt speed is adequate, or whether the 
10 traffic characteristics through the port can be ejfp€cted to the degrade the level of performance of 
the network such that an increase in neft speed is required. A graphical user interface and a 
display system may display a pprt^end analysis report. A port trend analysis report may include 
a graphical view of dat^^tfaffic through the port in terms of the size of bursts, which may be 
^fj categorized into by^^ranges, may include the number of bits transmitted in each burst range, and 
lO may include^trend in the changes of data transmissions for each burst range. Also, the port 
trend ap^fysis system may recommend a specific change in port speed based upon the calculated 

i3 The port trend analysis system provides a system for automatically assessing the data 

transmission performance of a port residing in a communication device in a bursty network. This 

2y system includes a means for collecting burst statistics from a port, a means for storing the burst 
13 statistics, a means for specifying a report period of interest, a means for specifying a plurality of 
summary periods where each summary period corresponds to a portion of the reporting period, 
and a means for retrieving the burst statistics from storage. When the retrieving means retrieves 
the burst statistics, only those burst statistics corresponding to a summary period of interest are 

25 retrieved. The port trend analysis system then employs a classification means wherein the burst 
statistics are classified according to a predefined burst range, each burst range corresponding to a 
predetermined percentage range of rated port speed. As each burst statistic is classified into a 
burst range, the classification means accumulates the total number of bits transmitted during the 
burst into a bit total for each burst range for each summary period. The port trend analysis 
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system may further comprise means for presenting the burst statistics and trends in a port trend 
analysis report and a means for displaying the port trend analysis report. 

In addition, the port trend analysis system includes a means for recommending a specific 
change in port speed based upon the trend analysis. That is, if the burst statistics and trend 
5 analysis indicate that the rate of data transmission is increasing across the summary periods, then 
the port trend analysis system will recommend an increase in port speed by a predetermined 
amount. Likewise, if burst statistics and trend analysis indicate a decrease in data transmission, 
the port trend analysis system may recommend a decrease in port speed. 

The present invention can also be conceptualized as providing a method for analyzing 
10 burst statistics to determine and predict performance of a port residing in a communication 
device. In accordance with one embodiment of the port trend analysis system, the method may 
comprise the steps of: collecting burst statistics from a port, storing the burst statistics, 
% specifying a report period of interest, specifying a plurality of summary periods where each 
summary period corresponds to a portion of the reporting period, retrieving selected burst 
ig statistics from storage where the selected burst statistics correspond to a summary period, 
jJ. processing the selected burst statistics into performance parameters which correspond to the 
actual performance of the port during each of the summary periods, categorizing the performance 
Q periods into burst ranges representative of the speed of data transmissions through the port, 
1,1 trending the performance parameters to predict future performance of the port, and 
2^ recommending a port speed based upon the analysis of the trends. Optionally, the method may 
O further comprise displaying the results of the trend analysis. 

Other systems, methods, features, and advantages of the port trend analysis system will be 
or become apparent to one with skill in the art upon examination of the following drawings and 
detailed description. It is intended that all such additional systems, methods, features and 
25 advantages be included with this description, be within the scope of the port trend analysis 
system, as defined in the accompanying claims and be protected by the accompanying claims. 

BRIEF DESCRIPTION OF THE DRAWINGS 

The port trend analysis system, as defined in the claims, can be better understood with 
30 reference to the following drawings. The components within the drawings are not necessarily to 



9 



TKHR Docket No. 061607-1470 



scale relative to each other, emphasis instead being placed on clearly illustrating the principles of 
the port trend analysis system. 

FIG. 1 is a block diagram illustrating a prior art communication environment; 

FIG. 2 is a block diagram illustrating a port trend analysis system employing the port 
5 trend analysis report logic of the present invention; 

FIG. 3 is a high level flow diagram illustrating the operation of the port trend analysis 
system of FIG. 2; 

FIG. 4 is a graphical and tabular representation of a port trend analysis report generated 
by the port trend analysis system of FIGs. 2, 3 and 5; and 
10 FIG. 5 is a flov^ diagram illustrating in greater detail the recommended port size logic of 

the port trend analysis system of FIGs. 2 and 3. 



DETAILED DESCRIPTION OF THE INVENTION 

The port trend analysis report system in accordance with the present invention can be 
iQ implemented in software, hardware, or a combination thereof In a preferred embodiment, the 
Q P*^^ trend analysis report system is implemented in software that is stored in a memory and that 
™ is executed by a suitable microprocessor (uP) situated in a personal computer (PC) or 
O workstation that is part of a communication network management system. However, the 
ul program implementing the port trend analysis report system, which comprises an ordered listing 
2M of executable instructions for implementing logical functions, can be embodied in any computer- 
S3 readable medium for use by or in connection with an instruction execution system, apparatus, or 
device, such as a computer-based system, processor-containing system, or other system that can 
fetch the instructions from the instruction execution system, apparatus, or device and execute the 
instructions. 

^^^^,^^^^-25^^^^^ context of this docum^ii^a "computer-readable medium" can be any means that 

"Contain, store, communicate, propagatfe^^r transport the program for use by or in connection 
with the instruction execution system, apparatu^>sOr device. The computer readable medium can 
be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or 
semiconductor system, apparatus, device, or propagatiorKmedium. More specific examples (a 
30 nonexhaustive list) of the computer-readable medium would mdude the following: an electrical 
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connection (electronic) having one orjmore wires, a portable computer diskette (magnetic), a 
random access memory (RAM) (electronic), a read-only memory (ROM) (electronic), an erasable 
programmable read-only memory (EI ROM or Flash memory) (electronic), an optical fiber 
(optical), and a portable compact disc read-only memory (CDROM) (optical). Note that the 
computer-readable medium could even be paper or another suitable medium upon which the 
program is printed, as the program can be electronically captured, via for instance optical 

, then compiled, interpreted or otherwise processed in a 
ored in a computer memory. 
FIG. 2 shows a block diagram illustrating a preferred embodiment of the port trend 
10 analysis system, which is generally denoted by reference numeral 62. Port trend analysis system 
62 contains a number of elements that allow for the performance analysis and management of a 
communication device 24a (FIG. I) that is operating in communication environment 22 (FIG. 1). 
In accordance with a preferred embodiment of the present invention, port trend analysis system 
62 includes database 74, processor 64, local interface 77 and memory 88. In the preferred 
IIS embodiment of port trend analysis system 62, port trend analysis logic 86 and data presentation 
ii' module 80 reside in memory 88. Memory 88 is in communication with processor 64 over local 
interface 77 via lines 78 and 90. Port trend analysis system 62 may reside in any convenient 
Q location in a network management system (not shown), or may reside in or adjacent to 
i^l communication device 26a (FIG. 1), or may reside at a location selected by the user. In an 
?g alternative embodiment, port trend analysis system 62 may be implemented as software residing 
Q in a multi-function processor, such as but not limited to, a PC or a workstation. Such an 
alternative embodiment of port trend analysis system 62 would interface with other commonly 
known data presentation methods and/or apparatus without departing substantially from the 
functionality of a port trend analysis system. 
25 Another alternative embodiment of port trend analysis system 62 may not include 

database 74. Such another alternative embodiment would retrieve burst statistic information 
from other commonly known data accumulation systems without departing substantially from the 
functionality of a port trend analysis system. 

Processor 64 executes the port trend analysis logic 86 and the data presentation module 
30 80 in a manner described hereinafter. In an alternative embodiment, memory 88 may reside 
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outside of the port trend analysis system 62 in a convenient location. Another alternative 
embodiment of the port trend analysis system 62 may provide for database 74 to reside in 
memory 88 concurrently with the port trend analysis logic 86 and the data presentation module 
80, or in another commonly shared memory unit (not shown) residing outside of the port trend 
analysis system 62. 

Any of the above mentioned altemative embodiments of a port trend analysis system are 
intended to be within the scope of this disclosure and the claims of the port trend analysis system. 

Data poller 66 receives information, hereinafter known as burst statistics, for at least one 
port, such as port 40a and/or port 42a (see also FIG. 1). Data poller 66, in an altemative 
embodiment, may receive burst statistic information from ports residing in other communication 
devices (not shown). A burst can be categorized relative to the port speed, such as by a plurality 
of burst ranges where each burst range corresponds to a percentage range of the port speed. In 
the preferred embodiment, the port trend analysis system 62 analyzes five burst ranges (0%-20%, 
21%-40%, 41%-60%, 61%-80% and 81%-100% Of port speed). If the number of bits in the burst 
is added to all others for the given range during a predefined period, and the same is done for all 
ranges, the full set of burst ranges (five burst ranges in the preferred embodiment) can be said to 
represent a statistical picture of the port burstiness for the predefined period. In the preferred 
embodiment, the port trend analysis system 62 analyzes burst statistics with a predefined period 
of fifteen minutes, however any statistically relevant period and/or any number of burst ranges 
may be employed in altemative embodiments. 

Communication path 70 provides for communications between ports 40a or 42a and data 
poller 66 by any means or apparatus commonly employed in the communication arts, such as but 
not limited to, the facilities of the NSP network 30 (FIG. 1), standard telephony systems, 
microwave communication systems, radio frequency (RF) systems, satellite communication 
systems, or the like. Although ports 40a and 42a are shown as remotely connecting to port trend 
analysis system 62 through communication path 70, an altemative embodiment may connect the 
port trend analysis system 62 directly to communication device 24a. 

Data poller 66 receives burst statistics from only one port at a time. Thus, data poller 66 
would be monitoring port 40a, or data poller 66 would be monitoring port 42a, Altemative 
embodiments of the data poller 66 may provide for the monitoring of a plurality of ports residing 
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in a single communication device, such as communication device 24a, and provide to an 
alternative embodiment of the port trend analysis system a plurality of burst statistics 
corresponding to the above mentioned plurality of ports. 

Another alternative embodiment of the data poller 66 could provide communication paths 
to a plurality of communication devices for the monitoring of a plurality of ports residing in the 
plurality of communication devices. Here, a plurality of burst statistics corresponding to the 
above mentioned plurality of ports and plurality of communications devices would by provided 
to an alternative embodiment of the port trend analysis system. 

One skilled in the art will also realize that the apparatus and method of the port trend 
analysis system 62 will perform equally well when analyzing burst statistics from a port of any 
type of communication device employed within NSP network 30 (FIG. 1). For these alternative 
embodiments of a port trend analysis system, a port is defined to be the location or element in 
the communication device in which data traffic flow is monitored, regardless of the commonly 
applied name given to that location or element. For example, a port trend analysis system 62 
could analyze the performance of port 44a or port 46a of the network switch 34 of FIG. 1. Any 
such applications of the port trend analysis system 62 are intended to be within the scope of this 
disclosure and the claims of the port trend analysis system. 
j)^ J ^ata poller 66 collect i i buut sLatistiLs, sucli at^ the ilUmber ofby^ trans nillied within each - 
hmsi range of data, for the port being monitored. An apparatus/^d method for accumulating 
burst statistics is disclosed in commonly assigned co-pending I^S. Patent Application Serial No. 
09/118,106, entitled "SYSTEM AND METHOD EOR CHARACTERIZING BURST 
INFORMATION," filed on July 17, 1998, and whichX hereby incorporated by reference in its 
entirety. Data poller 66 supplies burst statistics in^icmnation over cormection 72 to database 74. 
In the preferred embodiment, burst statistics are/associated with the direction of travel of the data 
burst (Tx or Rx). The historical burst stafi^ics data residing in database 74 may be collected 
over any period of time that is pertinent m the user, such as, for example, a number of weeks or 
months. Such a pertinent time period residing in database 74 is referred to herein as the 
historical period. In some cases^adequate burst statistics may be obtained in as few as four 
complete summary periods (d^cribed hereinafter). However, the accuracy of the analysis 
typically improves as additicmal burst statistics data are obtained and saved in the historical 
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C ptiiioJ, Siiitt; - tlit; usage of a panicillaf port " may vary seasorm Hy or oth o rvvi ^e-cy r l ic all y ov € 

periods of time, the particular historical periods may be specified in one embodimeijtKjfthe port 
trend analysis system 62 by the user, thereby increasing the relevance of tije^data residing in the 
historical period. Periods of little interest (such as, for example, ngri^ds outside normal business 
hours) may be excluded from a historical period in order^t&^timize data storage in database 74. 
One skilled in the art will realize that the am9jiMlfof data that can be stored in the historical 
period will be determined by the size ofjh^^orage capability of database 74. Methods of storing 
data, methods of recycling out ojd^ta from the historical period and methods of cycling in of 
nev^ data into the historic^k^riod may be accomplished in any variety of techniques commonly 
10 employed in the ait^efaata management v^ithout adversely impacting the functionality of the port 
trend analysi^^stem 62. Also, historical data for multiple ports may be saved to database 74. 
This ad)imonal data enables alternative embodiments of the Processor 64 to prepare port trending 
T - cpmt o foT g - plurality of ports - using on ly-encdatabase 7iLS> 
^fl Processor 64 executes the port trend analysis logic 86 to retrieve the historical burst 

Ig statistics data from database 74. Processor 64 then executes port trend analysis logic 86 to 



analyze the historical burst statistics data, and the results of this analysis being used to generate 
the port trend analysis report as discussed in detail hereinafter. 
O Processor 64 prepares the port trend analysis report by executing the data presentation 

I module 80, which formats the analyzed data for presentation. One skilled in the art v^ill realize 
2p that data presentation module 80 may format the data for presentation in any suitable format 
13 commonly employed in the art such as, but not limited to, graphical reports, tabular reports, or a 
combination of graphical and tabular reports. Any such report prepared by processor 64 may be 
displayed on any suitable device, such as but not limited to, a CRT, a line printer, an X-Y plotter 
or a flat panel display screen. 
25 In the preferred embodiment, processor 64 forwards the formatted report over connection 

82 to graphical user interface (GUI) 84. GUI 84 prepares the data for viewing by a network 
administrator or network engineer on display 92 via connection 94. 

Port trend analysis system 62 provides for the analysis and display of port performance 
for various time periods of interest. The time period of interest is defined by the reporting period 
30 and the summary periods, as defined hereinafter. For example, a network engineer may be 
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operating a user interface 96, such as a keyboard or the Hke, and request a port trend analysis 
report, via connection 98, for a specified port over a specified reporting period. The port trend 
analysis system 62 automatically provides the network engineer with a report (a sample of which 
is illustrated in FIG. 5) and a determination of whether the port is performing as desired. If port 
performance is below the user's acceptable level of performance, an alternative embodiment of 
the port trend analysis system 62 predicts when port capacity may become over-utilized and 
recommends a new performance rating, such as but not limited to a specific adjustment to port 
speed, so that the desired port performance can be known. 

For an illustrative example, port trend analysis system 62 may be analyzing the 
performance of port 42a residing in communication device 24a. Data pertaining to the amount of 
data transmitted through port 42a and the rate at which the data is transmitted through the port 
42a may indicate that port utihzation is approaching the rated port speed of port 42a. In this 
situation, port trend analysis system 62 would indicate to the network engineer that actual port 
utilization was, at times, approaching rated port speed, trend the port utilization to predict when 
the port capacity may become over-utilized, and recommend a change in performance rating, 
such as, but not limited to, a specific increase of the rated port speed of port 42a. 

Similarly, historical data collected by the port trend analysis system 62, may indicate that 
actual port utilization is significantly below the rated port speed of port 42a. In this under 
utilization scenario, port trend analysis system 62 would recommend to the network engineer a 
change in performance rating corresponding to the amount by which the rated port speed of port 
42a could be reliably decreased. 

FIG. 3 is a high level flow chart 102 illustrating the operation of the preferred 
embodiment of a processor 64 of FIG. 2 as applied to generating a typical port trend analysis 
report 132 shown in FIG. 5. Flow chart 102 shows the architecture, functionality, and operation 
of a possible implementation of the software for implementing the port trend analysis system 62 
(FIG. 2). In this regard, each block may represent a module, segment, or portion of code, which 
comprises one or more executable instructions for implementing the specified logical function(s). 
It should also be noted that in some altemative implementations, the fiinctions noted in the 
blocks may occur out of the order noted in FIG. 3 or include additional fiinctions without 
departing substantially from the overall fixnctionality to be achieved. For example, two blocks 
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shown in succession in FIG. 3 may in fact be executed substantially concurrently, the blocks may 
sometimes be executed in the reverse order, or some of the blocks may not be executed in all 
instances, depending upon the functionality involved, as will be further clarified hereinbelow. 

In block 104, the user, such as a network administrator or a network engineer, specifies a 
plurality of summary periods and a report period for the port for which data traffic will be 
analyzed, hi the preferred embodiment, a summary period includes the days and the times of the 
day that are of interest. For example, as will be described in greater detail in FIG. 4 hereinafter, a 
summary period may be defined as the days of Monday through Friday, and the hours between 
8:00 a.m. and 5:00 p.m. The report period encompasses the plurality of summary periods. Each 
summary period must encompass the same corresponding period of time consequently within the 
reporting period. For example, and as will be explained in greater detail with FIG. 4 hereinafter, 
a reporting period could include five summary periods (Monday through Friday, 8:00 a.m. to 
5:00 p.m.) and a specification of the starting date of each summary period (five consecutive 
Mondays). 

One skilled in the art will appreciate that the above example of a summary period and a 
reporting period are merely intended as illustrated examples. One alternative embodiment of 
processor 64 would provide user capability to specify a summary period and a reporting period 
tailored to the particular needs of the user. Another alternative embodiment would require the 
user to specify the port of interest when database 74 (FIG. 2) contains historical data for multiple 
ports. 

In block 106, bit totals in each burst range are set to zero. A burst range is defined 
hereinafter as some pre-determined percentage of the rated port capacity or rated port speed. In 
the preferred embodiment, and as illustrated in FIG. 4, five burst ranges are defined. These burst 
ranges are 0%-20%, 21%-40%, 41%-60%, 61%-80% and 81%- 100%. In altemative 
embodiments, the user may specify a plurality of burst ranges and/or the magnitude of each burst 
range. 

In block 108, burst statistics for each predefined period are retrieved from database 74 
(FIG. 2). Then, at block 110, the number of bits in each burst range and predefined period is 
added to the current bit total of its respective burst range for the summary period. 
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At block 112, a test is made to determine if all of the burst statistics for the specified 
reporting and summary periods have been retrieved from database 74 (FIG. 2). If additional 
burst statistics are to be collected from database 74, the NO condition, the process returns to 
block 108 and another data burst statistic is retrieved from database 74. If all of the burst 
statistics have been collected for the specified reporting period, the YES condition, the process 
continues to block 1 14. 

In block 114, accumulated burst statistics for each burst range and summary period are 
analyzed by processor 64 (FIG. 2) to determine the port trend statistics as described hereinafter. 
After port trend statistics have been calculated, the process continues to block 1 16 where a port 
trend analysis report is processed. Then, at block 1 18, a graphics of the port trend analysis report 
is generated and the report is displayed to the user. The process then ends. 

FIG. 4 shows an illustrative example of a computer display screen on display 92 (FIG. 2) 
and represents the preferred embodiment of a port trend analysis report 132 generated by the 
processor 64 (FIG. 2), prepared by the data presentation module 80 and displayed by graphical 
user interface 84. This illustrative port trend analysis report 132 could be displayed to a network 
administrator or a network engineer on display 92 or any other suitable device. The port trend 
analysis report 132 shown in FIG. 4 consists of a bar chart and a data table as shown. For 
illustrative purposes, a report preparation date (reference number 134) of December 15 in the 
year of interest (12/15/**) is shown and represents the date at which the port trend analysis report 
was prepared. The report period 136 is shown to be from November 9 through December 12. 
The summary period 138 has been selected to be, in this illustrative example, Monday through 
Friday between the hours of 8:00 a.m. to 5:00 p.m. Burst statistics for the summary period are 
shown by a bar 134 on the bar chart, and in a column 140 of the data table. For example, the 
farthest right side bar 134 of the bar chart is shown to begin on Monday, December 7 as shown 
by date 142. The summary period ends five days later on Friday, December 12, which coincides 
with the end of the report period described above. Therefore, with the report period and 
summary periods as defined in this illustrative example, the port trend analysis report 132 is seen 
to have five summary periods beginning on the dates shown below each corresponding bar on the 
bar chart, as denoted in the table row showing the weeks 144. Altemative embodiments of the 
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port trend analysis system may allow the user to specify the number of summary periods in the 
report period, or allow the user to specify multiple reporting periods. 

The port trend analysis report 132 may also provide other miscellaneous information 146 
of interest to the user. Li the preferred embodiment shown in FIG. 4, this information includes 
the direction of port transmission, here in the Tx direction; the port location Tampa; the port 
speed of 256 kbps; the port K) (card 3, port 7); and a maintenance period. Also, the name of the 
user who is preparing the report, L. Swift, is shown 148. This miscellaneous information may be 
included on the report without departing substantially from the functionality of the present 
invention. 

As previously described, this illustrative example of a port trend analysis report 132, 
provides for five burst ranges. These burst ranges are 0%-20%, 21%-40%, 41%-60%, 61%-80%, 
81%- 100%. Additionally, each burst range corresponds to a particular portion of a bar 134 on 
the bar chart. For example, the burst range category 21%)-40%, is shown as a white portion 
having forward slash marks 150. Alternative embodiments of the port trend analysis system 
provide for specifying any number of burst ranges. In practice, each of the burst ranges shown on 
port trend analysis report 132 may be plotted with a unique color and/or a unique coding symbol 
to clearly identify the bar portion being plotted on bar 1 34. 

Looking now to the table shown on the port trend analysis report 132, a number is shown 
in each cell of the table which corresponds to the number of bits in the final bit total of each burst 
range for each summary period. Each bit total is determined in block 112 of FIG. 3. For 
example, in the burst range 152 of 81%- 100% for the week of November 16, 4.1 giga-bits were 
recorded as going into the bit total for the report period starting on Monday, November 16, at 
8:00 a.m. and ending on Friday, November 20, at 5:00 p.m. 

The last number in each of the columns is a total count of giga-bits collected over the 
summary period for all burst ranges. For example, for the summary period beginning on 
Monday, November 16, the total giga-bits 154 counted during that summary period was 34.8 
giga-bits. This total of 34.8 giga-bits is equal to the sum of the giga-bits counted for each of the 
individual burst ranges (4.1 + 1.5 + 5.2 + 7.9 + 16.1 = 34.8). 

In summary, one portion of the port trend analysis report 132 table indicates the number 
of bits counted in each burst range for each summary period, and the total number of giga-bits 



18 



TKHR Docket No. 061607-1470 



counted in each summary period. Alternative embodiments of the port trend analysis system may 
provide for indicating the number of bytes transmitted or some like comparable unit 
representative of data transmission rates. 

The port trend analysis report 132 shown in FIG. 4 is for a port transmit direction, Tx. In 
the preferred embodiment, the user may also specify preparation of a port trend analysis report 
132 for the same port in the Rx direction. Another alternative embodiment could perform an 
analysis for both the TX and Rx directions, could display the report for the direction specified by 
the user, or select and display the report for the direction having the more significant usage. 

Trending information for each burst range and trending information for the total giga-bits 
transmitted (or received) is shown in the far right hand column 156 of the data table of the port 
trend analysis report 132. The method of determining trend values and the application of the 
trend value information to determine a recommended port speed will be described hereinafter. 
For the illustrative example of a port trend analysis report 132 of FIG. 4, a trend of 15% is shown 
for burst range 41%-60% (reference numeral 158). This trend value of 15% indicates that the 
trend of the bits counted in the 41%-60% burst range for the five summary periods is increasing 
at a rate of 15%. The total trend rate of 32% (reference numeral 160) indicates that the total 
giga-bits for each of the summary periods is increasing at a rate of 32%. One skilled in the art 
will appreciate that the trending information provided by the port trend analysis report will 
indicate to a network administrator or a network engineer whether or not a particular 
communication device port has adequate port speed, or port capacity, and whether or not a 
change in port speed should be planned for. For example, the recommended port speed 182 
shown in the illustrative port trend analysis report 132 of FIG. 4 is 306 kbps. Because the 
recommended port speed of 306 kbps exceeds the current port speed of 256 kbps, the network 
administrator or network engineer would realize that the present port speed of 256 kbps will 
likely not be adequate in the future. Thus, the network administrator or network engineer could 
anticipate the need to upgrade port speed and based upon the recommended port speed of 306 
kbps, recommend an appropriate upgrade to the port (i.e., next higher available increment of port 
speed). 

Once all of the burst statistics have been retrieved from database 74 (FIG. 2) for the entire 
report period, as shown in blocks 108 through 1 14 of the flow chart 102 (FIG. 3), trending for bit 
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totals in each of the burst ranges and each of the summary periods can be determined. Trending 
is determined by applying a statistical linear regression method to the bit totals for each burst 
range across the summary periods. For example, the trend of 15% for the 41%-60% burst range 
(FIG. 4) is the result of a linear regression analysis of the following points: 4.4, 5.2, 6.4, 7.9 and 

5 8.6, which correspond to the bit totals shown in the 41%-60% burst range row 164. Ahemative 
embodiments of the port trend analysis system employ different statistical regression analysis 
methods. Application of any such statistical analysis methods is intended to be within the scope 
of this disclosure and be protected by the claims for the port trend analysis system. 

An alternative embodiment of the port trend analysis system would, in the event that port 
10 speed was inadequate or that the trending analysis indicated that port speed would become 
inadequate in the future, predict the time at which port speed would become inadequate and 
display the predicted time on the port trend analysis report. This alternative embodiment would 

'"f use commonly known statistical methods to project trending information so that the predicted 

in time could be determined. Similarly, another altemative embodiment of the port trend analysis 

IB 

IQ system could predict the time at which a recommended decrease in port speed would be 

'-^ II 

desirable. Any such altemative embodiments are intended to be within the scope of this 
O disclosure and be protected by the claims for the port trend analysis system. 

FIG. 5 is a flow chart 202 illustrating the architecture, functionality, and operation of a 
preferred embodiment for software for implementing the determination of a recommended port 
2^ speed. In this regard, each block may represent a module, segment or portion of code, which 
□ comprises one or more executable instructions for implementing the specified logical function(s). 
It should also be noted that in some altemative implementations, the functions noted in the 
blocks may occur out of the order noted in FIG. 5, or may include additional functions without 
departing substantially from the overall functionality to be achieved. For example, two blocks 
25 shown in succession in FIG. 5 may, in fact, be executed substantially. Concurrently, the blocks 
may sometimes be executed in reverse order, or some of the blocks may not be executed in all 
instances, depending on the functionality involved, as will be further clarified hereinbelow. 

The process of determining a recommended port speed begins at block 204 where the bit 
count of the 81%- 100% burst range, hereinafter referred to as the top burst range, is analyzed. If 
30 the bit count in the top burst range is greater than zero for any of the summary periods of the port 
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trend analysis report 132 (FIG. 4) the process proceeds to step 218, as described hereinafter. If 
the bit counts in each of the top burst ranges are zero, then the process proceeds to block 206. 

At block 206, the trend of the total traffic (see also reference numeral 160 at FIG. 4) is 
examined to determine if the trend is down or stable. Stable is defined hereinafter to be any trend 
value between the range of ±10%. A trend is defined hereinafter as down if the trend value is 
less than -10%, and a trend is defined hereinafter as increasing if the trend value is greater than 
10%. In block 206, if the trend is down or stable (10% or less), the process proceeds to block 



At block 208, a determination is made whether the next to highest burst range is less than 
or equal to zero. In the illustrative example shown in FIG. 4, block 208 would analyze the 61%- 
80% burst range. If the YES condition is satisfied, the process proceeds to block 210 where a 
recommendation is made to reduce port speed to 60%. The process then ends. 

However, at block 208, if the trend of the next highest burst range is greater than zero, the 
NO condition, then the process proceeds to block 212. At block 212, a determination is made 
whether the trend of total traffic is stable. If the NO condition is satisfied then the process 
continues to block 214 where no change to port speed is recommended. However, a future 
decrease in port speed is projected, and thus notifies the network administrator or network 
engineer to evaluate the port on an on-going basis so that the timing of a reduction in port speed 
can be identified. The process then ends. 

If at block 212 a determination is made that the total traffic is stable, the YES condition, 
then the process proceeds to block 216 where no change to port speed is recommended. The 
process then ends. 

Summarizing the process as described thus far, if there are no bits counted in the top burst 
range and if the trend of the total traffic is down or stable, the port trend analysis system will 
recommend that the port speed be decreased to 60%> if the trend of the next highest range is less 
than zero. The port trend analysis system will recommend no change (but project a future 
decrease in port speed) if the trend of the next highest range is greater than zero and total traffic 
is decreasing. The port trend analysis system will recommend no change to the port speed if the 
trend of the next highest range is greater than zero and the trend of total traffic is stable. 



208. 
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Returning now to block 206, if the trend of total traffic is upwards (equivalent to not 
down or not stable), the NO condition is satisfied and the process proceeds to block 216 where 
no change in port speed is recommended. The process then ends. 

Returning now to block 204, if any of the bit counts in the top burst range are greater than 
zero, the process proceeds to block 218. At block 21 8, a determination is made whether the trend 
of the total traffic is down. If so, the YES condition, the process proceeds directly to block 216 
which indicates that no change is recommended to the port speed. The process of recommending 
port speed then ends. Summarizing, the network administrator or the network engineer will 
realize that even though there are occasional bursts of data within the 81%- 100% burst range, the 
overall trend in data transmission is down and that no upgrade in port speed may be required at 
the time of the port trend analysis report date. Also, the network administrator and network 
engineer will realize that the downward trend in total traffic transmission may not be sufficient so 
as to warrant a decrease in port speed. Therefore, the network administrator or network engineer 
would realize that no changes are warranted. 

However, if the trend of the total traffic is not down, as tested at block 218, the process 
continues to block 220. That is, the process continues to block 220 if the trend of total traffic is 
either stable (±10%) or increasing (greater than 10%). 

At block 220, a determination is made whether the trend of the total traffic transmitted is 
stable. If so, the YES condifion, the process proceeds to block 222. At block 222, a 
determination is made in this embodiment whether the trend of the top burst range is less than 
20%. If so, the YES condition, the process proceeds to block 224. At block 224, the port trend 
analysis report 132 (FIG. 4) indicates to the network administrator or network engineer that an 
increase in port utilization is projected. The process then continues to block 216 where no 
change to the port speed is recommended. The process then ends. Summarizing, the network 
administrator or network engineer may then realize that this port should be monitored on an on- 
going basis. 

If at block 220 the trend of the total traffic is not stable, the NO condition, the process 
proceeds to block 226. At block 226, the recommended increase to the rated port speed, in this 
embodiment, will be 20%. The process then ends. Summarizing, the network administrator or 
the network engineer may realize that the bit count of the top burst range is increasing (greater 



22 



^^TKHR Docket No. 061607-1470 

than 10%), that the trend in total traffic transmitted is increasing (greater than 10%), and that the 
port speed might be increased by at least 20%. 

Returning now to block 222, if the NO condition is satisfied, that is the trend of the top 
burst range is greater than or equal to 20%, the process proceeds to block 226 and a 
recommendation is made to increase the rate of the port speed by 20%. The process then ends. 
Summarizing, the network administrator or the network engineer may realize that the bit count of 
the top burst range is increasing at a rate greater than 20% and that the port speed might be 
increased. 

One skilled in the art will realize that the determination logic illustrated in FIG. 5, and as 
applied to the illustrative port trend analysis report 132 of FIG. 4, is intended as an illustrative 
example of the application of the port trend analysis system. The definition of a stable trend 
being plus or minus 10% is an arbitrary range which may be adjusted in alternative embodiments 
of a port trend analysis system depending upon the user's needs and the significance of the data. 
Likewise, the recommended increase of 20%> made at block 226 is arbitrary, and the increase 
amount could be any value in alternative embodiments as determined by the needs of the 
particular user. Also, the recommendation to reduce port speed to 60%) of rated port speed, as 
specified at block 210 of FIG. 5, could be changed in alternative embodiments to any other 
percentage reduction in port speed. Any such applications or variations of the port trend analysis 
system are intended to be within the scope of this disclosure and the claims of the port trend 
analysis system. 

In summary, statistics on the port usage are accumulated over a period of time and stored 
in a database 74 (FIG. 2). A network administrator or network engineer, or another interested 
user, would then request the port trend analysis system 62 to prepare a port trend analysis report 
132 (FIG. 4) by specifying a report period and a plurality of summary periods covering some part 
or all of the stored statistics. In the preferred embodiment, as illustrated in FIG. 4, the user 
would specify five summary periods beginning on a specified starting report period date (report 
period 1 1/9/** through -12/12/**, five summary periods each beginning on Monday at 8:00 a.m. 
and running through Friday at 5:00 p.m.). The processor 64 (FIG. 2) would then retrieve the 
categorized burst data from database 74 (FIG. 2) for the relevant summary periods. The 
processor 64 would total the number of bits in each of the five burst ranges during each summary 
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period and then, for each of the five burst ranges and five summary periods, determine a trending 
of the bits transmitted using a Hnear regression analysis technique. Then, the processor 64 would 
make a determination, using the method outlined in the flow chart of FIG. 5, to recommend 
either a decrease in port speed, no change in port speed, or an increase in port speed. One skilled 
in the art will realize that the recommended increase, decrease or no change in port speed made 
by the processor 64, is intended to provide guidance to the network administrator or the network 
engineer in the design, operation and maintenance of a communication system 22 (FIG. 1). The 
ultimate decision to increase, decrease or not change port speed would be made by the network 
administrator or the network engineer based upon the information provided by the port trend 
analysis system 62 (FIG. 2) and the totality of other factors and circumstances in which the 
communication system 22 operates. 

It should be emphasized that the above-described embodiments of the port trend analysis 
system, particularly, any "preferred" embodiments, are merely possible examples of 
implementations, merely set forth for a clear understanding of the principles of the invention. 
Many variations and modifications may be made to the above-described embodiment(s) of the 
invention without departing substantially from the spirit and principles of the invention. All such 
modifications and variations are intended to be included herein within the scope of the port trend 
analysis system, as defined in the claims that follow. 
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